ITIL Example emergency change management procedure

An example emergency change process diagram

Emergency RFC Actually logging of the emergency request for change can all be done retrospectively

Emergency Change Manager Calls ECAB ELAPSED TIME Logging of the emergency RFC

ECAB Quickly assesses impact, risk, resource and urgency Emergency? NO Normal change procedure

YES NO Change Builder(s) (Technology Expert) Urgently builds change and devises backout plan if time is available YES NO

TIME TO TEST?

Change Tester (independent if possible)

Urgent testing

SUCCESS?

Change Builder(s) Coordinates change implementation

YES

WORKING?

NO

Change Builder(s) Implements backout plan (if appropriate)

YES Change Manager Change Manager ensures that the emergency RFC is complete and that a change review is completed CLOSED Back to start of process

U C I S A

I T I L :

A N

E X A M P L E

E M E R G E N C Y

C H A N G E

M A N A G E M E N T

P R O C E D U R E

1.
1.1

Roles identified in the emergency change process

The Change Manager

The role of the Change Manager in the emergency change process is to ensure that the ECAB is convened to discuss the emergency change and make the decision either to implement the change or to re-categorise and take time to plan the change. The Change Managers also ensure that all activities to implement the emergency change are undertaken in an appropriate manner and are documented (which can be retrospective).

1.2 Change Initiators

Anyone can initiate an emergency change within the organisation however, consideration must be given to whether this should include all users. It is important to remember that the number of emergency changes needs to be limited as they are a risk activity and should be limited to occasions that need recovery of business critical services and systems and to protect the organisation. Any changes outside these categories should be planned through the normal change process.

1.3 The ECAB

The Emergency Change Advisory Board is a group called together by the Change Manager to act as decision makers on ALL changes that are categorised as emergency. This group usually meet virtually as the nature of emergency change means that it has been be agreed and authorised immediately. The ECAB is made up or high level individuals who are relevant in the making the decisions on whether a change should take place immediately as an emergency or if it should be delayed and given an alternative category.

1.4 The Change Builder(s)

The Change Builder(s) is the appropriate technology subject matter expert who will ensure that all necessary hardware, software, licences etc are available to complete the building of the change prior to sending to be tested. The Change Builder(s) could be any of the staff within IT but the Change Builder must be identified in the RFC to ensure that anyone else involved within the emergency change process knows to which technical expert to direct questions and issues. The Change Builder will also recommend the types of testing that are appropriate for each change.

1.5 The Change Tester

Wherever possible, with all emergency changes, the Change Tester should not be the Change Builder this is to ensure rigorous and error free testing. However, under the emergency change process there may not be any time for any testing this has to be considered as a risk and documented in the emergency RFC.

1.6 The Change Implementer

The Change Implementer will usually be the technology subject matter expert who was the Change Builder. If the emergency change implementation needs external third party or supplier involvement this needs to be documented within the emergency request for change form.

1.7 The Change Reviewers

The emergency Change Reviewers are a group called together by the Change Manager once the emergency change has been implemented to review and close out the emergency request for change.

2. Reasons for emergency changes

The number of emergency changes should be kept to an absolute minimum, because they are generally more disruptive and prone to failure. All changes likely to be required should, in general, be foreseen and planned, bearing in mind the availability of resources to build and test the changes. However, there will be occasions when emergency changes are essential and so the emergency change process and underpinning procedure has been documented to deal with these types of changes quickly, without sacrificing normal management controls. 2

U C I S A

I T I L :

A N

E X A M P L E

E M E R G E N C Y

C H A N G E

M A N A G E M E N T

P R O C E D U R E

The process diagram for the emergency change process is shown at the start of this procedure. Emergency changes should only be accepted for one of the following two reasons: To correct any issue/issue(s) on a business critical system or service To protect the business/organisation

The ECAB (Emergency Change Advisory Board) need to ensure that the request for emergency change is in line with one of the two reasons given above.

2.1 Emergency change building, testing and implementation

Approved emergency changes should be allocated to the relevant technical group for building. The Change Manager, in collaboration with the appropriate technical manager(s), should ensure that sufficient staff and resources (machine time etc.) are available to do the emergency change. Backout plans should still be devised despite the urgency of implementing emergency change. As much testing of the emergency change as is possible should be carried out. Completely untested changes should not be implemented if at all avoidable. The emergency change management process should give as much advance warning as possible to customers and users about any imminent emergency changes. This should be done via the service desk. When any emergency changes are implemented, particularly those that have not been adequately tested, change management should ensure that an adequate technical presence is available to tackle any Incidents that may occur after the emergency change has been implemented.

3. The emergency change process

3.1 Initiating an emergency change
Only the IT teams have access to the request for change form to initiate emergency changes. However, it is common that as the change is needed urgently that the emergency request can be made to the Change Manager verbally so that the ECAB can be called immediately. All documentation within the emergency RFC can be done retrospectively for emergency changes. All other requests for emergency change either from users and anywhere else in the organisation need to be considered as to how they can be initiated via, i.e. via the service desk, via the change intranet site etc.

3.2 Authorisation of an emergency change by the CAB/EC

3.2.1 ECAB meetings The Change Manager will always act as the Chair of any ECAB meetings, which are normally virtual, and will call together the required Emergency Change Authorisers. The Change Manager will need to explain the emergency change and give details of all information that is available. The ECAB is made up of senior staff/senior managers the nature of emergency change is that authorisation MUST be made a senior level. 3.2.2 Discussion/consideration items for the CAB Risk of implementing the emergency change on the business and risk of NOT implementing the emergency change on the business Impact of implementing the emergency change on the business and impact of NOT implementing the emergency change on the business Security implications/risks Costs Resource requirements Potential impact on other services that run on the same infrastructure (or on software development projects) Technical capability and technical approval Financial Approval (if required)
I T I L : A N E X A M P L E E M E R G E N C Y C H A N G E M A N A G E M E N T P R O C E D U R E

U C I S A

Third party/supplier involvement in the implementation of the emergency change Impact on other services that run on the same infrastructure (or on software development projects) Business approval (if required) Review/assessment of the change it may be considered that this change in NOT an emergency and is so the change is reprioritised and processed through the normal change management process

3.2.3 ECAB comments/issues All ECAB comments on each emergency change and any Issues that have been discussed must be documented by the Change Manager within the ECAB meeting information section of the request for change form. This information may be completed retrospectively once the emergency change has been implemented. 3.2.4 ECAB recommendations/decisions All ECAB recommendations and decisions that have been discussed must be documented by the Change Manager within the ECAB meeting information section of the request for change form. This information may be completed retrospectively once the emergency change has been implemented. 3.2.5 ECAB authorisation/approval Once all aspect of the emergency change have been considered (as per the ECAB discussion/consideration items above) the ECAB will then give authorisation for the emergency change to be progress into the emergency change build stage of the process. The Change Manager will update the change authorised By section of the request for change form with the names of all the Emergency Change Authorisers. Formal authorisation can be added with electronic signatures, if required. This information may be completed retrospectively once the emergency change has been implemented. 3.2.6 Reprioritisation of an emergency change by the ECAB If the ECAB rejects the emergency change as an emergency priority the change is reprioritised and processed through the normal change process. The Change Manager must inform the Change Initiator and give the reasons for the reprioritisation, and ensure that the change is submitted via the normal change management process. 3.2.7 Rejection of an emergency change by the ECAB If the ECAB rejects the emergency change and decide that it is not appropriate for the change to be considered even through the normal change management process, the Change Manager must inform the Change Initiator that the change has been rejected.

3.3 Scheduling of an emergency change

Only when the ECAB have authorised an emergency change can the emergency change be scheduled. The scheduling must reflect that this emergency change must be implemented immediately. The Change Manager will liaise with other IT managers/team leaders to ensure that the appropriate resources are allocated to the emergency change. 3.3.1 Additional emergency change information Change Builder identified Full name and department. Type of testing identified What type of testing (if any) needs to be completed prior to the change being implemented. As this is an emergency change if not testing is to be carried out NO testing needs to be documented in the request for change form and any potential risks identified if no testing will take place. Change Tester identified Full name and department. This information may be completed retrospectively once the emergency change has been implemented. The Change Manager has responsibility for ensuring that an emergency change is implemented as immediately, though this will be largely a coordination role as the actual implementation will be completed by the appropriate IT team/group.

U C I S A

I T I L :

A N

E X A M P L E

E M E R G E N C Y

C H A N G E

M A N A G E M E N T

P R O C E D U R E

3.4 Building of an emergency change

Once a Change Builder(s) has been identified the emergency change is communicated to the appropriate technology expert for building. 3.4.1 Activities of change building The Change Builder(s) will carry out the following activities, as appropriate for the emergency change: building a new production module creating a new version of one or more software modules purchasing equipment or services externally, if appropriate and time allows preparing a hardware modification producing new or amended documentation showing the components of the change build devising a backout plan, if time in the emergency change allows devising testing requirements, if time in the emergency change allows ensuring that required resources for the emergency change implementation are identified

3.4.2 Details of the emergency change backout plan The Change Builder(s) needs to document an emergency change backout plan if time allows. High level information on the details of the emergency change backout plan needs to be documented in the request for change form in the section details of the change backout plan, but this again can be completed retrospectively. The name of the person who can authorise the emergency change backout plan with any relevant contact information also needs to be identified. 3.4.3 Emergency change building completed Once all emergency change build activities have been completed The Change Builder will complete date change building completed section of the request for change form, this can be completed retrospectively. 3.4.4 The Change Manager role during emergency change building The Change Manager has a coordination role during emergency change building alongside the normal line management controls, to ensure that the emergency change building activities are both resourced and also completed as a matter of urgency. The Change Manager also ensures that a backout plan is in place, if time allows.

3.5 Testing of an emergency change

Once the Change Builder(s) has completed all emergency change build activities the change is passed to a Emergency Change Tester for independent testing, only if time allows. 3.5.1 Activities of the Emergency Change Tester To prevent emergency changes from adversely impacting on service quality, it is strongly recommended that the Emergency Change Tester will carry out the following activities to ensure that the emergency change is thoroughly tested in advance (including backout procedures) where possible given the urgent implementation time. Testing should include aspects of the change such as: performance security functionality testing of the backout plan documenting testing carried out and results

U C I S A

I T I L :

A N

E X A M P L E

E M E R G E N C Y

C H A N G E

M A N A G E M E N T

P R O C E D U R E

3.5.2 Details of the emergency testing carried out The Emergency Change Tester needs to document all testing carried out, but this can be documented retrospectively. 3.5.3 Backout plan tested The Emergency Change Tester needs to ensure that the emergency backout plan is tested and that this is documented in the request for change, if time allows and the documentation can be completed retrospectively. 3.5.4 If emergency change failed testing reason for test failure The Change Tester needs to communicate if the emergency change failed testing and the reasons for this failure. The Change Tester may also make any observations or recommendations that they feel would be useful for the Emergency Change Builder as part of the rebuild of the emergency change. 3.5.5 The Change Manager role during change testing The Change Manager has an overseeing role to ensure that all emergency changes that can be, are thoroughly tested. In all cases involving emergency changes that have not been fully tested, special care needs to be taken during implementation. The Change Manager should assess the risk to the business of any emergency change that is to be installed without complete testing having taken place.

3.6 Implementation of an emergency change

3.6.1 Emergency change communicated to To ensure that the appropriate parts of the business, other IT groups and the user are aware of any emergency changes that will impact them the Emergency Change Implementer needs to ensure that change is communicated at an appropriate time BEFORE the emergency change is implemented. 3.6.2 Scheduled emergency implementation The Emergency Change Implementer will agree a suitable time as a matter of urgency to ensure that the emergency change is implemented as quickly as possible. 3.6.3 Issues encountered implementing an emergency change Issues encountered during the emergency change implementation need to be documented. Even if issues are encountered that do not lead to the use of the backout plan they must be documented to ensure that they are known and discussed at the change review. These issues need to be documented by the Change Implementer in the request for change form. These issues can be documented retrospectively. 3.6.4 Emergency backout plan implemented Y/N If the emergency backout plan was implemented this needs to be documented by the Emergency Change Implementer in the request for change form. This can be documented retrospectively. 3.6.5 Emergency change backout authorised by If the emergency change was backed out, the Emergency Change Implementer needs to update the request for change form with the name of who authorised the backout. This can be documented retrospectively. 3.6.6 Emergency change successfully implemented Once the Emergency Change Implementer has confirmed that the emergency change implementation is stable the information in the RFC can be documented. 3.6.7 The Change Manager role during change emergency implementation The Change Manager has an overseeing role to ensure that all emergency changes are implemented quickly the Change Manager also needs to ensure that adequate resource is provided to ensure implementation of the emergency change takes place quickly.

U C I S A

I T I L :

A N

E X A M P L E

E M E R G E N C Y

C H A N G E

M A N A G E M E N T

P R O C E D U R E

3.7 Reviewing an emergency change

After the emergency change implementation has been completed, the Change Manager needs to review the change. 3.7.1 Emergency review information The Change Manager must review all implemented emergency changes after a predefined period has elapsed. This process may still involve ECAB members; change management may look to them for assistance in the review process. Review information: The emergency change has had the desired effect and met its objectives Users and customers are content with the results, or to identify any shortcomings There have been no unexpected or undesirable side effects to functionality, availability, capacity/performance, security, maintainability etc. The resources used to implement the emergency change were made available and suitable The implementation plan worked correctly (so include comments from the implementers) The emergency change was implemented quickly as agreed The backout plan functioned correctly, if the backout plan was implemented

Where an emergency change has not achieved its objectives, the Change Manager (or the ECAB) should decide what follow up action is required, which could involve raising a new RFC. If the review is satisfactory the emergency change information should be checked to ensure that all fields have been completed and formally documented into the RFC form, and then the status should be set to CLOSED.

U C I S A

I T I L :

A N

E X A M P L E

E M E R G E N C Y

C H A N G E

M A N A G E M E N T

P R O C E D U R E